Failsafe Automation System

ABSTRACT

An input system and failsafe automation system, wherein the failsafe automation system includes a motion controller connected to multiple failsafe processors that are each respectively associated with a safety level, and wherein the motion controller includes at least one associated drive, where the respective drive is respectively associated with areas and each respective area has an associated safety level that indicates the level of (fail)safety level with which the respective area needs to be established such that the failsafe automation system allows individual areas in spaces such as production halls to be easily equipped with the necessary (fail)safety level.

BACKGROUND OF THE INVENTION 1. Field of the Invention

The invention relates to a failsafe automation system, an input systemfor the failsafe automation system and an installation.

2. Description of the Related Art

Failsafe automation systems are used to control and/or regulate drivesin safety-relevant areas, such as an industrial installation. Toincrease safety, automation systems involve, by way of example, safeinput methods being used, individual elements of the automation systembeing embodied redundantly (i.e., repeatedly) and/or the transmission ofsignals between the individual elements being configured safely.

In this regard, EP 2 192 461 A1 describes a control apparatus and asystem for failsafe data transmission.

In installations, particularly production machines, there are areas inwhich parts of the installation require different standards forfailsafety.

SUMMARY OF THE INVENTION

The various features of novelty which characterize the invention arepointed out with particularity in the claims annexed to and forming apart of the disclosure. For a better understanding of the invention, itsoperating advantages, and specific objects attained by its use,reference should be had to the drawing and descriptive matter in whichthere are illustrated and described preferred embodiments of theinvention.

It is an object of the invention to provide an automation system that isflexibly adaptable to suit different safety requirements.

This and other objects and advantages are achieved in accordance withthe invention by a failsafe automation system, where the failsafeautomation system includes a motion controller and at least one failsafeprocessor. The failsafe automation system optionally has drives. Thefailsafe automation system is used to control and/or regulate aplurality of drives. The drives are controlled and/or regulated bypreferably using the motion controller. The drives are respectivelyassociated with an area, where the respective area has a respectiveassigned safety level and where the areas are respectively arrangedadjacently, particularly physically adjacently, to one another.

The failsafe processor may be formed as a separate hardware component.The failsafe processor may similarly be integrated in the motioncontroller and/or in the drive. The failsafe processor is preferablyformed as a software block or as an additional computer program.

An automation system is understood to mean at least part of a drivesystem. The automation system advantageously has components, such as amotion controller, particularly a programmable logic controller (PLC)and, if needed processors, such as switching elements or networkadapters (proxies, hosts) and optionally drives. The drives respectivelyhave a converter and a motor. A failsafe automation systemadvantageously has a failsafe motion controller and/or failsafeprocessors, where the failsafe processors check, by way of example, thetransmission of signals from the motion controller to the drives. Anautomation system advantageously has a data connection for transmittingdata and/or signals.

The installation is particularly in the form of a production machine,machine tool or industrial installation, where the installation has afailsafe automation system as described here.

The drives are advantageously connected to the motion controller. Thedrives have a converter or a frequency converter and an electricmachine, particularly an (electric) motor. In line with the safetylevel, a drive comprises a brake and/or a transmitter, if needed. Thebrake is preferably used to more quickly slow down the drive and/or toensure the drive is at a standstill. Advantageously, a brake shortensthe action time of the respective drive. The transmitter is preferablyused to verify the motion of the drive. Both the brake and thetransmitter may be connected to the motion controller.

A safety level can be understood to mean that a drive comes to astandstill from its respective speed of movement in a prescribed time(action time). The higher the safety level, the shorter the prescribedaction time before the drive comes to a standstill. To increase thesafety level, it is moreover possible for a mechanical and/or electronicbrake to be used.

Depending on the use of the drive, a determined safety level may beprescribed in accordance with statutory provisions. By way of example,in areas of an industrial installation in which people are busy, thesafety level is particularly high.

In this case, failsafety can mean that:

failure of individual components is prevented by a redundant design ofcritical components such as the motion controller, or a processor,

a stipulated maximum slowing time (action time) may be prescribed forthe respective drive,

a failsafe data connection is configured to safely transmit data and/orsignals from one component to a further component,

and/or further components, such as a brake or an additional transmitter,prevent a malfunction of the respective drive.

A failsafe automation system is understood to mean an automation systemthat has one or more of the aforementioned features of failsafety.

A failsafe automation system or a failsafe drive system may respectivelyalso be distinguished by a maximum speed for the respective drive.

A failsafe automation system may additionally or alternatively bedistinguished by a stipulated reaction in the event of an (arriving)signal. As such, by way of example, it may be stipulated that opening acover is possible only after a stipulated period of time when there is asignal.

In this case, a safety level is understood to mean that the respectivedrive that is associated with the safety level has an associated periodof time, particularly a (re)action time. The stipulated period of timeis the period of time during which the drive comes to a standstill atthe latest. The stipulated period of time may also be the period of timeafter which the respective drive produces no further torque. In thiscase, the stipulated period of time is also referred to as the actiontime.

A failsafe processor can be understood to mean a module that supports orguarantees secure transmission of data between the motion controller andthe respective drive. Therefore, a failsafe processor is preferably alsoconfigured as a communication module. By way of example, a failsafeprocessor is a failsafe proxy block. Failsafe also means that it ispossible for failsafe interaction between multiple blocks to occur in anotherwise non-failsafe environment.

Preferably, the space in which the drives are located is divided into aplurality of areas. Advantageously, the areas are physically adjacentand optionally substantially contiguous. A space is particularly an areaof a production hall. The space has, by way of example, a first area, asecond area and a third area. The first area can have the actualinstallation or production machine, particularly a press. The first areahas an assigned first, such as low, safety level.

Extending around the installation there is, by way of example, thesecond area. The second area advantageously contains apparatuses forequipping the installation. Here, there may possibly be a need foractivities that are required to be performed manually. Therefore,protection of people in the second area may necessitate a higher safetylevel. Finally, the second area can adjoin the third area. The thirdarea may be distinguished by regular activities that are required to beperformed manually. Therefore, a high safety level is necessary in thisthird area.

In this example, the space is split into the three areas, where eachrespective area has an associated separate safety level. The areas arerespectively arranged adjacently in the space, i.e., the two areasrespectively have a common boundary or they are at least situated closeto one another.

The areas may also be separated by physical boundaries, such as accesslocks, room dividers, corridors or (light) curtains.

The division of the space, such as a production hall, into areas havinga respective safety level allows the respective drive situated in therespective area to be allocated a safety level. The allocation can, inthis case, occur independently of the connection of the respective driveto the motion controller. The assignment of an area or a safety levelallows an installation to be configured more easily.

Hence, the aforementioned object is achieved by virtue of the designbeing able to be designed flexibly by virtue of the association of therespective drive with the area or with a safety level.

In the case of one advantageous embodiment of the failsafe automationsystem, a respective area has an associated failsafe processor. Here,the failsafe processor advantageously monitors the operation of therespective drive in the associated area. Advantageously, the failsafeprocessor is moreover connected to the motion controller.

The failsafe processor also advantageously ensures the data interchangeand/or the signal interchange between the motion controller and theapplicable drive.

The respective failsafe processor is advantageously associated with therespective applicable area. As such, a failsafe processor may beconnected to the motion controller for a respective area and/or for arespective safety level.

In one advantageous embodiment of the failsafe automation system, arespective area has an associated failsafe processor.

The association of a respective separate failsafe processor with an areaallows the respective failsafe processor to be adapted in accordancewith the safety level of the respective area. As such, it is possible,by way of example, for adapted failsafe processors to be used fordifferent safety levels. An area having a safety level with lowrequirements may therefore be associated with a failsafe processor. Anarea having a high safety level may, in accordance with therequirements, be associated with a particularly powerful failsafeprocessor.

In summary, the respective safety level may thus be guaranteed by arespective adapted failsafe processor.

Advantageously, an area can also be allocated multiple failsafeprocessors.

The allocation of (at least) a respective failsafe processor to arespective area allows the failsafety of the automation system to beincreased.

In a further advantageous embodiment of the failsafe automation system,the respective drive and/or the respective failsafe processor areconnected via a failsafe data connection.

A failsafe data connection is understood to mean a data connection forwhich there is the assurance that the correct signals or the correctdata arrive at the envisaged time, with the envisaged signal strength.Further, it is possible, particularly through a redundant embodiment,for the transmission of the correct data to be checked. A failsafetransmission may, by way of example, be formed by a redundanttransmission with a subsequent comparison.

An example of a failsafe data connection is PROFIBUS or PROFINET fromthe Siemens AG company. Another failsafe data connection is provided, byway of example, via PROFIsafe addressing.

The safe transmission of data and/or signals means that the connectionof the individual components advantageously also meets the chosen safetystandard. In addition, errors in the transmission of signals or data arespotted.

In a further embodiment of the failsafe automation system, therespective safety level has an assigned action time, where the actiontime is a period of time from a trigger signal to the action of therespective drive.

An action time is, by way of example, the period of time that a switchneeds to change a switching state. The monitoring time can also comprisemultiple switching times and/or braking times. The presentlycontemplated embodiment allows compliance with the safety-relevantstandards to be guaranteed easily and in a manner free of sources oferror.

In a further advantageous embodiment, the respective failsafe processorcomprises a failsafe IO controller (input/output controller).

The failsafe processor is used particularly to avoid errors during thetransmission of data and/or signals. A failsafe processor thereforeadvantageously comprises an IO controller (input/output controller),particularly for what is known as I-device device communication, by wayof example, for a further processor or a further component. Hence, it ispossible for a non-failsafe component to become a failsafe component.

The failsafe processor may also be in the form of what is known as anl-slave, particularly for what is known as l-slave communication for aprocessor, particularly a non-failsafe processor, or a correspondingcomponent. A non-failsafe processor is also referred to as a standardprocessor. The latter embodiment can also be combined with failsafecomponents, particularly further failsafe processors.

Additionally, the failsafe processor may also be provided for datatransmission and/or signal transmission from and to a (further) failsafeprocessor. This is also referred to as an l-slave for direct datainterchange and/or signal interchange.

The failsafe processor may also be provided as an IO controller having a(further) failsafe processor, particularly for failsafe transmission ofsignals and/or data. This is also referred to as shared devicefunctionality.

The above-listed options can also be used in combination.

The use of a failsafe processor as a failsafe IO controller allows anon-failsafe automation system to be upgraded, at least on an area byarea basis, to produce a failsafe automation system.

In a further advantageous embodiment of the failsafe automation system,the failsafe processors are respectively interconnected by a dataconnection.

Advantageously, the failsafe processors are also interconnected.Preferably, the failsafe processors are connected using a failsafe dataconnection.

The connection of the failsafe processors allows compliance with theapplicable safety standard, by way of example, by virtue ofcommunication being diverted or the machine being powered down in acontrolled manner.

Failsafe processors are preferably in the form of software modules. Thefailsafe processors are then connected by a data interchange of thesoftware modules.

The interconnection of the failsafe processors is preferably used forredundancy when there are multiple failsafe processors. As such, afailsafe processor in slave mode can forward data and/or signals to afailsafe processor in master mode. In a redundant configuration,particularly the (direct) connection of the failsafe processors is usedfor fast interchange of data.

In a further advantageous embodiment of the failsafe automation system,the drives and/or the failsafe processors are respectively associatedwith a zone. Advantageously, the zone is in the form of a respectiveplane in a network or another connection scheme of the data connection.Different zones can respectively have different safety levels.

A zone can be understood to mean a failsafe zone. As such, drives forwhich there are no particular safety demands can be allocated to a firstzone. The first zone can therefore be distinguished by a low safetylevel to no safety level. In the first zone, there is thus only a singleassociated failsafe processor. If need be, there may also be no need atall for a failsafe processor.

A network is understood, in this case, to mean the connection scheme ofthe individual components of the automation system.

In addition, a network may also have a second and/or a third zone withhigher safety standards. The increased safety need necessitates a higherlevel of failsafety. An improved failsafe transmission of data and/orsignals in the zones of the network, which ensures failsafecommunication in the network, can be guaranteed by further failsafeprocessors that are associated with the respective zone of the network.

The association of zones in a network of an automation networkparticularly allows the data transmission and/or signal transmission tobe adapted to suit the requirements of failsafety for the individualdrive.

In a further embodiment of the failsafe automation system, therespective failsafe processor, the respective motion controller and/orthe respective drive are in redundant form.

A redundant form of a component, such as a motion controller, a(failsafe) processor or a (failsafe) data connection, means that thefailsafe automation system has the respective component repeatedly. Assuch, two components, such as two failsafe processors, can interact withone another such that in a normal mode the first component forms amaster and performs applicable functions and the second component formsa slave and performs applicable functions. If a malfunction is detectedfor the first failsafe processor, then the second failsafe processor(previously in the slave function) replaces the first failsafeprocessor. The second failsafe processor can continue in the masterfunction, while the first failsafe processor is transferred to a slavefunction. In the event of a malfunction in the master, the master/slavedivision is thus changed.

In a redundant embodiment of a data transmission by a failsafe dataconnection, the data and/or the signals are routed via the at least twodata connections. Advantageously, the transmitted data or signals arecollated.

Advantageously, the data connection is used to perform a data comparisonor a signal comparison between the individual components of theautomation system.

In a further advantageous embodiment of the failsafe automation system,the failsafe automation system additionally includes an input system,where the input system is provided for the purpose of providing signalsfor the failsafe automation system, and where the input system isconfigured to assign the respective safety level for the respectivedrive.

The input system is advantageously configured analogously to anengineering system. The input system is preferably used for interactionwith the user, where the user is able to stipulate motion sequences forthe individual drives. In the advantageous embodiment, the user can alsoallocate the safety level, the respective failsafe processor and/or therespective monitoring time to the respective drive or to anothercomponent.

The input advantageously occurs using an input means. The input systemmay, in one advantageous embodiment, be integrated in a control programor interact with the control program for data engineering purposes.

Advantageously, the input system is formed as a computer program or isformed as a computer program package. The input system can therefore beinstalled on a computation unit and executed on the computation unit. Tothis end, the input system is transferred to the main memory andexecuted using a processor of the computation unit. The input systemand/or the control program are advantageously used to provide data tothe motion controller and/or to the (failsafe) processors or drives.

The input system is advantageously also suitable for indicating thezones of the network that contain the failsafe processor, the respectivedrive and/or the respective motion controller.

Other objects and features of the present invention will become apparentfrom the following detailed description considered in conjunction withthe accompanying drawings. It is to be understood, however, that thedrawings are designed solely for purposes of illustration and not as adefinition of the limits of the invention, for which reference should bemade to the appended claims. It should be further understood that thedrawings are not necessarily drawn to scale and that, unless otherwiseindicated, they are merely intended to conceptually illustrate thestructures and procedures described herein.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention is described and explained in more detail below based onfigures. In this regard, the figures depict schematic or advantageousembodiments of the invention. It goes without saying that individualfeatures of the individual embodiments can be combined to form newembodiments without departing from the scope of the invention presentedhere, in which:

FIG. 1 shows a failsafe automation system in accordance with theinvention;

FIG. 2 shows a further failsafe automation system in accordance with theinvention;

FIG. 3 shows a further failsafe automation system in accordance with theinvention;

FIG. 4 shows an input system in accordance with the invention; and

FIG. 5 shows zones of a network of a failsafe automation system inaccordance with the invention.

DETAILED DESCRIPTION OF THE EXEMPLARY EMBODIMENTS

FIG. 1 shows a failsafe automation system in accordance with theinvention. The failsafe automation system includes a motion controllerBS, where the motion controller BS is connected to drives A1, A2, A3.The motion controller BS is connected to the respective drive A1, A2, A3by means of a data connection BUS, where the data connection BUSadvantageously comprises a failsafe data connection BUS. The drives A1,A2, A3 are respectively associated with an area S1, S2, S3. Here, afirst drive A1 is associated with a first area S1. In addition, a seconddrive A2 is associated with a second area S2 and a third drive A3 isassociated with a third area S3. The respective area S1, S2, S3 isrespectively associated with a failsafe processor F-CPU. The failsafeprocessor F-CPU is used to monitor the respective area S1, S2, S3. Thefailsafe processors F-CPU may also be integrated in the motioncontroller BS and/or in the respective drive A1, A2, A3.

FIG. 2 shows a further failsafe automation system in accordance with theinvention. In the case of the failsafe automation system shown here, themotion controller BS is respectively connected to a drive A1, A2, A3 viaa connection An1, An2, An3. For the purpose of connecting the motioncontroller BS to the respective drive Al, A2, A3, the data connectionBUS is used, advantageously configured as a failsafe data connectionBUS. Additionally, failsafe processors F-CPU are connected to the motioncontroller BS. The failsafe processors F-CPU and the motion controllerBS are advantageously likewise connected using a data connection BUS,where the data connection BUS particularly comprises an (industrial)Ethernet. The failsafe processors F-CPU may be provided for the purposeof providing failsafety for the respective connection An1, An2, An3 ofthe motion controller BS.

FIG. 3 shows a further failsafe automation system in accordance with theinvention. In the case of the failsafe automation system shown here, amotion controller BS is configured to control drives A1, A2, A3. For thepurpose of connecting the motion controller BS to the drives A1, A2, A3,a data connection BUS is used, where the data connection BUSadvantageously comprises a failsafe data connection BUS. The drives A1,A2, A3 are arranged in areas S1, S2, S3 of a space, particularly of aproduction hall or of an installation. The individual drivesrespectively comprise a motor M.

In this arrangement, the respective area S1, S2, S3 includes anassociated safety level F1, F2, F3. The individual areas are optionallyseparated from one another (not shown) by boundaries such as lightbarriers, access doors, in conjunction with partitions. The safety levelF1, F2, F3 (in this case) indicates the level of failsafety with whichthe respective drive A1, A2, A3 needs to be configured or needs tooperate. The failsafety of the individual drive A1, A2, A3 and/or therespective area S1, S2, S3 is indicated by an action time t1, t2, t3.The action time t1, t2, t3 is (in this case) used to stipulate howquickly a drive A1, A2, A3 needs to be slowed down to a standstill or toa rated speed. In the presently depicted example, two first drives A1are associated with a first area S1, where the first area S1 isassociated with a first safety level F1. In this example, the first areaS1 is configured to have the highest safety level Fl. The motioncontroller BS is further used to drive a second drive A2, where thesecond drive A2 is associated with a second area S2 and is located inthis area. The second area S2 has an associated second safety level F2.The safety level F2 is (in this case) lower than the first safety levelF1. Hence, the second monitoring time t2 is also advantageouslyconfigured to be longer than the first monitoring time t1. The motioncontroller BS is further used to drive a third drive A3, where the thirddrive A3 is associated with a third area S3. The third area S3 isassociated with a third safety level F3.

The third area S3 is characterized by a third action time t3, the actiontime t3 being able to be configured to be longer than the secondmonitoring time t2 and even longer than the first monitoring time t1.The safety level F1, F2, F3 is (in this case) oriented to the monitoringtime t1, t2, t3, where a short monitoring time t1, t2, t3 characterizesa high safety level F1, F2, F3. To monitor failsafety in the individualareas S1, S2, S3, failsafe processors F-CPU are associated with therespective safety levels F1, F2, F3 and the individual areas S1, S2, S3.Here, the failsafe processors F-CPU advantageously comprise failsafeHOST modules. The safety relevance of the first area S1 is highest inthis case. The first failsafe processor F-CPU is formed redundantly. Thefailsafe processors F-CPU comprise failsafe host modules F-HOST. Thenumbering 1, 2 and 3 among the applicable reference symbols (F-HOST)merely indicates that the redundantly formed failsafe processor may bethe same host model. The other two host models may be configureddifferently.

FIG. 4 shows an input system in accordance with the invention. The inputsystem has an input mask EM, where the input mask EM lists theindividual drives A1, A2, A3 and schematically depicts their respectiveconnection to the motion controller BS. As a parameter, the input maskhas the respective safety level F1, F2 for the respective drive A1, A2,A3. The respective area S1, S2, S3 can further be allocated a respectivesafety level F1, F2. The respective drive A1, A2, A3 can likewise beallocated a respective action time t1, t2, t3. The input mask is usedfor inputting the safety levels Fl, F2 and the areas S1, S3 for theindividual drives A1, A2, A3. The data that are input are transferredfrom the input system to the motion controller BS, where the motioncontroller BS is also advantageously able to use the relationships inputin the input mask to take action in a checking capacity. The allocationof the first drive A1 and the second drive A2 to the safety level S1 andthe allocation of the safety levels F1 and F2 to the area S1 are meantto indicate that it is also possible for multiple parameters to beallocated to one another.

FIG. 5 shows zones Z1, Z2, Z3 of a network of a failsafe automationsystem in accordance with the invention. Here, the zones Z1, Z2, Z3comprise network planes, where a first network plane comprises themotion controller, the second network environment or the second zone Z2includes at least one failsafe processor and a third zone or a thirdnetwork plane includes the respective drives A1, A2, A3. For the purposeof connecting the individual planes, a data connection BUS isadvantageously used. Individual zones Z1, Z2, Z3 may also bedistinguished and/or connected by failsafe data connections BUS.

In summary, one aspect of the invention relates to a failsafe automationsystem. A further aspect of the invention relates to an input system. Inthe case of the failsafe automation system, a motion controller BS isconnected to multiple failsafe processors F-CPU. The failsafe processorsF-CPU are respectively associated with a safety level S1, S2, S3. Themotion controller BS has at least one associated drive A1, A2, A3, wherethe respective drive A1, A2, A3 is respectively associated with areasS1, S2, S3 and the respective area S1, S2, S3 has an associated safetylevel F1, F2, F3. The safety level F1, F2, F3 indicates the level of(fail)safety with which the respective area S1, S2, S3 needs to beconfigured. The failsafe automation system allows individual areas S1,S2, S3 in spaces such as production halls to be easily equipped with thenecessary (fail)safety.

The invention is not limited by the embodiments described above whichare presented as examples only but can be modified in various wayswithin the scope of protection defined by the appended patent claims.

Thus, while there have been shown, described and pointed out fundamentalnovel features of the invention as applied to a preferred embodimentthereof, it will be understood that various omissions and substitutionsand changes in the form and details of the methods described and thedevices illustrated, and in their operation, may be made by thoseskilled in the art without departing from the spirit of the invention.For example, it is expressly intended that all combinations of thoseelements and/or method steps which perform substantially the samefunction in substantially the same way to achieve the same results arewithin the scope of the invention. Moreover, it should be recognizedthat structures and/or elements and/or method steps shown and/ordescribed in connection with any disclosed form or embodiment of theinvention may be incorporated in any other disclosed or described orsuggested form or embodiment as a general matter of design choice. It isthe intention, therefore, to be limited only as indicated by the scopeof the claims appended hereto.

1. A failsafe automation system, comprising: a motion controller for atleast one of (i) controlling and (ii) regulating a plurality of drives,each of said plurality of drives being respectively associated with anarea; and at least one failsafe processor; wherein each respective areaincludes a respective assigned safety level; and wherein respectiveareas are respectively arranged physically adjacently to one another. 2.The failsafe automation system as claimed in claim 1, wherein arespective area includes an associated failsafe processor.
 3. Thefailsafe automation system as claimed in claim 1, wherein at least oneof (i) a respective drive of the plurality of drives and (ii) arespective failsafe processor are connected via a failsafe dataconnection.
 4. The failsafe automation system as claimed in claim 2,wherein at least one of (i) a respective drive of the plurality ofdrives and (ii) a respective failsafe processor are connected via afailsafe data connection.
 5. The failsafe automation system as claimedin claim 1, wherein the respective assigned safety level includes anassigned action time; wherein a monitoring time comprises a period oftime from a trigger signal to an action of a respective drive of theplurality of drives.
 6. The failsafe automation system as claimed inclaim 1, wherein the at least one failsafe processor comprises one of(i) a failsafe IO controller and (ii) a DP-l slave.
 7. The failsafeautomation system as claimed in claim 1, wherein failsafe processors arerespectively connected to one another via a data connection.
 8. Thefailsafe automation system as claimed in claim 7, wherein at least oneof (i) each drive of the plurality of drives and (ii) the failsafeprocessors are respectively associated with a zone.
 9. The failsafeautomation system as claimed in claim 1, wherein at least one of (i) theat least one failsafe processor, (ii) the motion controller and (iii)each drive of the plurality of drives are in a redundant form.
 10. Thefailsafe automation system as claimed in claim 1, further comprising: aninput system for providing signals for the failsafe automation system;wherein the input system is configured to assign the respective assignedsafety level for a respective drive of the plurality of drives.
 11. Aninput system for a failsafe automation system as claimed in claim 1,wherein an input mask is utilizable to assign at least one of (i) asafety level, (ii) the at least one failsafe processor and (iii) amonitoring time to at least one drive of the plurality of drives.
 12. Aninstallation having the failsafe automation system as claimed inclaim
 1. 13. An installation having the input system as claimed in claim11.
 14. The installation as claimed in claim 12, wherein theinstallation comprises one of (i) a production machine, (ii) a machinetool and (iii) an industrial installation.
 15. The installation asclaimed in claim 13, wherein the installation comprises one of (i) aproduction machine, (ii) a machine tool and (iii) an industrialinstallation.